Regression : blink::Node hanging on multiple websites |
||||||||||||||||
Issue descriptionVersion:54.0.2832.0 OS: Windows What steps will reproduce the problem? (1)Launch chrome -> Go to https://www.youtube.com/ (2)Now try to click on any video and observe Expected: Should be able to click on any Video in you tube Actual: Instead Unable to click the Video in you tube This is Regression Issue broken in M-54 will provide bisect info soon
,
Aug 18 2016
Additional repro steps: ------------------------- 1. Play videos from Youtube.com 2. Click on YoutTube icon on the top to navigate to youtube home page 3. Now try clicking on any videos 4. Page goes unresponsive and kill the tab it crashes Note: ------ 1. For consistent repros we need to click the different videos continuously. 2. Issue is able to reproduce it on Windows-10 as well. 3. Marking it as RB-Dev for now, Please feel free to edit or remove if this is not the case. Crash ID's: --------------- 9ee4532100000000 - Windows-7 8388d32100000000 - Windows-10 Stack Trace: ------------- Thread 0 MAGIC SIGNATURE THREAD 0x000007feca0ca53b (chrome_child.dll -flattreetraversal.cpp:43 ) blink::canBeDistributedToInsertionPoint 0x000007feca0cab2d (chrome_child.dll -flattreetraversal.cpp:169 ) blink::FlatTreeTraversal::traverseParent(blink::Node const &,blink::LayoutTreeBuilderTraversal::ParentDetails *) 0x000007feca0627e4 (chrome_child.dll -node.cpp:951 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0627fb (chrome_child.dll -node.cpp:952 ) blink::Node::canStartSelection() 0x000007feca0e6e52 (chrome_child.dll -eventhandler.cpp:761 ) blink::EventHandler::selectAutoCursor(blink::HitTestResult const &,blink::Node *,blink::Cursor const &) 0x000007feca0e6a79 (chrome_child.dll -eventhandler.cpp:661 ) blink::EventHandler::selectCursor(blink::HitTestResult const &) 0x000007feca0e8360 (chrome_child.dll -eventhandler.cpp:1061 ) blink::EventHandler::handleMouseMoveOrLeaveEvent(blink::PlatformMouseEvent const &,blink::HitTestResult *,bool,bool) 0x000007feca0e7b4a (chrome_child.dll -eventhandler.cpp:944 ) blink::EventHandler::handleMouseMoveEvent(blink::PlatformMouseEvent const &) 0x000007fecb4f1323 (chrome_child.dll -pagewidgetdelegate.cpp:206 ) blink::PageWidgetEventHandler::handleMouseMove(blink::LocalFrame &,blink::WebMouseEvent const &) 0x000007fecb4f1175 (chrome_child.dll -pagewidgetdelegate.cpp:137 ) blink::PageWidgetDelegate::handleInputEvent(blink::PageWidgetEventHandler &,blink::WebInputEvent const &,blink::LocalFrame *) 0x000007fecb4d3355 (chrome_child.dll -webviewimpl.cpp:2221 ) blink::WebViewImpl::handleInputEvent(blink::WebInputEvent const &) 0x000007fecb8c8946 (chrome_child.dll -render_widget_input_handler.cc:324 ) content::RenderWidgetInputHandler::HandleInputEvent(blink::WebInputEvent const &,ui::LatencyInfo const &,content::InputEventDispatchType) 0x000007fecb8359f1 (chrome_child.dll -render_widget.cc:675 ) content::RenderWidget::OnHandleInputEvent(blink::WebInputEvent const *,ui::LatencyInfo const &,content::InputEventDispatchType) 0x000007fecb8322b6 (chrome_child.dll -ipc_message_templates.h:121 ) IPC::MessageT<InputMsg_HandleInputEvent_Meta,std::tuple<blink::WebInputEvent const *,ui::LatencyInfo,content::InputEventDispatchType>,void>::Dispatch<content::RenderWidget,content::RenderWidget,void,void ( content::RenderWidget::*)(blink::WebInputEvent const *,ui::LatencyInfo const &,content::InputEventDispatchType)>(IPC::Message const *,content::RenderWidget *,content::RenderWidget *,void *,void ( content::RenderWidget::*)(blink::WebInputEvent const *,ui::LatencyInfo const &,content::InputEventDispatchType)) 0x000007fecb836506 (chrome_child.dll -render_widget.cc:473 ) content::RenderWidget::OnMessageReceived(IPC::Message const &) 0x000007fecb808006 (chrome_child.dll -render_view_impl.cc:1379 ) content::RenderViewImpl::OnMessageReceived(IPC::Message const &) 0x000007fecbc93237 (chrome_child.dll -message_router.cc:52 ) IPC::MessageRouter::RouteMessage(IPC::Message const &) 0x000007fecb3bffeb (chrome_child.dll -child_thread_impl.cc:773 ) content::ChildThreadImpl::OnMessageReceived(IPC::Message const &) 0x000007fecb1cfe23 (chrome_child.dll -bind_internal.h:303 ) base::internal::InvokeHelper<1,void>::MakeItSo<void ( media::DXVAVideoDecodeAccelerator::*const &)(media::VideoDecodeAccelerator::Config const &),base::WeakPtr<media::DXVAVideoDecodeAccelerator> const &,media::VideoDecodeAccelerator::Config const &>(void ( media::DXVAVideoDecodeAccelerator::*const &)(media::VideoDecodeAccelerator::Config const &),base::WeakPtr<media::DXVAVideoDecodeAccelerator> const &,media::VideoDecodeAccelerator::Config const &) 0x000007fecb8a4295 (chrome_child.dll -input_event_filter.cc:254 ) content::InputEventFilter::HandleEventOnMainThread(int,blink::WebInputEvent const *,ui::LatencyInfo const &,content::InputEventDispatchType) 0x000007fecb8f4048 (chrome_child.dll -main_thread_event_queue.cc:108 ) content::MainThreadEventQueue::PopEventOnMainThread() 0x000007fec9c32572 (chrome_child.dll -task_annotator.cc:54 ) base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask const &) 0x000007fecb48835c (chrome_child.dll -task_queue_manager.cc:315 ) blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(blink::scheduler::internal::WorkQueue *,blink::scheduler::internal::TaskQueueImpl::Task *) 0x000007fecb487944 (chrome_child.dll -task_queue_manager.cc:218 ) blink::scheduler::TaskQueueManager::DoWork(base::TimeTicks,bool) 0x000007fecb8f45ba (chrome_child.dll -bind_internal.h:303 ) base::internal::InvokeHelper<1,void>::MakeItSo<void ( content::AudioRendererSinkCacheImpl::*const &)(media::AudioRendererSink const *,bool),base::WeakPtr<content::AudioRendererSinkCacheImpl> const &,media::AudioRendererSink const * const &,bool const &>(void ( content::AudioRendererSinkCacheImpl::*const &)(media::AudioRendererSink const *,bool),base::WeakPtr<content::AudioRendererSinkCacheImpl> const &,media::AudioRendererSink const * const &,bool const &) 0x000007fec9c32572 (chrome_child.dll -task_annotator.cc:54 ) base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask const &) 0x000007fec9bcbfb7 (chrome_child.dll -message_loop.cc:488 ) base::MessageLoop::RunTask(base::PendingTask const &) 0x000007fec9bccea4 (chrome_child.dll -message_loop.cc:621 ) base::MessageLoop::DoWork() 0x000007fec9c34216 (chrome_child.dll -message_pump_default.cc:35 ) base::MessagePumpDefault::Run(base::MessagePump::Delegate *) 0x000007fec9c1e95c (chrome_child.dll -run_loop.cc:35 ) base::RunLoop::Run() 0x000007fecb80cccb (chrome_child.dll -renderer_main.cc:198 ) content::RendererMain(content::MainFunctionParams const &) 0x000007fecace3bfe (chrome_child.dll -content_main_runner.cc:418 ) content::RunNamedProcessTypeMain(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &,content::MainFunctionParams const &,content::ContentMainDelegate *) 0x000007fecace3a3a (chrome_child.dll -content_main_runner.cc:785 ) content::ContentMainRunnerImpl::Run() 0x000007fecace2e87 (chrome_child.dll -content_main.cc:20 ) content::ContentMain(content::ContentMainParams const &) 0x000007feca87eafd (chrome_child.dll -chrome_main.cc:85 ) ChromeMain 0x000000013f2aa95d (chrome.exe -main_dll_loader_win.cc:183 ) MainDllLoader::Launch(HINSTANCE__ *) 0x000000013f2a9ac3 (chrome.exe -chrome_exe_main_win.cc:250 ) wWinMain 0x000000013f494a4d (chrome.exe -exe_common.inl:255 ) __scrt_common_main_seh 0x777d59bc (kernel32.dll + 0x000159bc ) BaseThreadInitThunk 0x77a0a2e0 (ntdll.dll + 0x0002a2e0 ) RtlUserThreadStart Bisect Information: --------------------- Good build: 54.0.2831.0 Bad Build : 54.0.2832.0 Change Log URL: https://chromium.googlesource.com/chromium/src/+log/a2e00444025eca4d094285409c85b8fbbb8a26ac..bffc32eb63e5e211a1f2bd44cae8c91bc5ac2922 From the above change log suspecting below change Review-Url: https://codereview.chromium.org/2021793002 yoichio@ - Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner. Thanks!
,
Aug 18 2016
Issue is also seen on Linux OS
,
Aug 18 2016
Reproducible on the latest canary(54.0.2832.0) on Mac OS 10.11.5 as well.
,
Aug 18 2016
There are 8 out of 11 different variant of magic signatures(same regression range and suspect) on the latest canary(54.0.2832.0- crash data of 2 hours) of Windows. No crash data for Mac canary(triggered 1 hour ago) is generated yet to update the behaviour. Various Magic signatures: ========================== 1. [Renderer hang] blink::FlatTreeTraversal::traverseParent. Crash id: 8367372200000000 2. [Renderer hang] blink::FlatTreeTraversal::traverseParentOrHost. Crash id: f1d9d72200000000 3. [Renderer hang] blink::canBeDistributedToInsertionPoint. Crash id: 6ff5ab2100000000 4. [Renderer hang] blink::HTMLElement::draggable. Crash id: 11ced72200000000 5. [Renderer hang] blink::hasEditableLevel. Crash id: e87b372200000000 6. [Renderer hang] blink::Node::canStartSelection. Crash id: ced3fde900000000 7. [Renderer hang] blink::Node::isChildOfV0ShadowHost. Crash id: 12e4f32100000000 8. [Renderer hang] blink::AttributeCollectionGeneric<blink::AttributeArray const ,blink::AttributeArray const >::find. Crash id: 2a072b2100000000 yoichio@: Can we get an update on this as this is blocking today's Dev release. Cc'ing reviewers as well for more inputs. Note: Canary was pushed late to the users due to Issue 638809. That's why there are very less crash data as of now. This would probably spike further with more crash data coming in. Requesting MTV team to follow up on this.
,
Aug 18 2016
Restrict-View for Crash issue. Short Link to the list of the magic signatures on Windows chrome canary: https://goto.google.com/mcgsz
,
Aug 18 2016
This or a similar issue causes renderer hangs on today's Mac canary (54.0.2832.0). Sampling of hung renderers shows they are spending 100% of their time in blink::Node::canStartSelection(). ajha@, I don't think this crash is sensitive, and many canary users will hit this bug today - can we open this bug back up so they can see it?
,
Aug 18 2016
Sure ellyjones@. Removing Restrict view per C#7.
,
Aug 18 2016
I got [Renderer hang] blink::Node::isChildOfV0ShadowHost today on my main corp machine. crash/c5272f2200000000. Chrome 54.0.2832.0
,
Aug 18 2016
In fact, Chrome 54.0.2832.0 canary (64-bit) seems totally unusable at the moment on Windows. Gmail tab hangs reliably every time I load it. If https://codereview.chromium.org/2021793002 is the suspected CL it should be reverted.
,
Aug 18 2016
I confirmed by looking at crashes that 08acdf950e1776571def8e6f16c288769e7e9e27 is definitely the culprit CL so I am reverting it now.
,
Aug 18 2016
Thank you wfh@ for reverting the culprit CL. Gmail tab hanging bug is being tracked in issue 638973
,
Aug 18 2016
Issue 638973 has been merged into this issue.
,
Aug 18 2016
it's all the same issue, and this will contain the revert, so duping everything to here.
,
Aug 18 2016
Thanks! Removing from stability sheriff queue as this seems under control.
,
Aug 18 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/29cd7243aa6537f9e1517568a299e8187bb3b230 commit 29cd7243aa6537f9e1517568a299e8187bb3b230 Author: wfh <wfh@chromium.org> Date: Thu Aug 18 18:54:29 2016 Revert of [Editing][CSS] Drag from a -webkit-user-select:none element should not start selection (patchset #3 id:80001 of https://codereview.chromium.org/2021793002/ ) Reason for revert: this is causing hangs on latest canary. crbug.com/638868 Original issue's description: > [Editing][CSS] Drag from a -webkit-user-select:none element should not start selection > > This CL is updated of reverted one: > https://codereview.chromium.org/2001993002 > > This CL considers the reverted shadow boundary issue. > > BUG= 481985 > > Committed: https://crrev.com/08acdf950e1776571def8e6f16c288769e7e9e27 > Cr-Commit-Position: refs/heads/master@{#412457} TBR=tkent@chromium.org,yosin@chromium.org,yoichio@chromium.org # Not skipping CQ checks because original CL landed more than 1 days ago. BUG= 481985 , 638868 Review-Url: https://codereview.chromium.org/2256083003 Cr-Commit-Position: refs/heads/master@{#412903} [modify] https://crrev.com/29cd7243aa6537f9e1517568a299e8187bb3b230/third_party/WebKit/LayoutTests/editing/selection/mouse/drag_user_select_none.html [delete] https://crrev.com/196420669e24edf2ba2d8d2811e690232bcac9ad/third_party/WebKit/LayoutTests/editing/selection/mouse/select_user_select_in_shadow.html [modify] https://crrev.com/29cd7243aa6537f9e1517568a299e8187bb3b230/third_party/WebKit/Source/core/dom/Node.cpp
,
Aug 18 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/930a07e51ed363faa31a9f54625c86da1ee171e5 commit 930a07e51ed363faa31a9f54625c86da1ee171e5 Author: Will Harris <wfh@chromium.org> Date: Thu Aug 18 19:51:42 2016 Merge 2832: Revert of [Editing][CSS] Drag from a -webkit-user-select:none element should not start selection (patchset #3 id:80001 of https://codereview.chromium.org/2021793002/ ) Reason for revert: this is causing hangs on latest canary. crbug.com/638868 Original issue's description: > [Editing][CSS] Drag from a -webkit-user-select:none element should not start selection > > This CL is updated of reverted one: > https://codereview.chromium.org/2001993002 > > This CL considers the reverted shadow boundary issue. > > BUG= 481985 > > Committed: https://crrev.com/08acdf950e1776571def8e6f16c288769e7e9e27 > Cr-Commit-Position: refs/heads/master@{#412457} TBR=tkent@chromium.org,yosin@chromium.org,yoichio@chromium.org BUG= 481985 , 638868 Review-Url: https://codereview.chromium.org/2256083003 Cr-Commit-Position: refs/heads/master@{#412903} (cherry picked from commit 29cd7243aa6537f9e1517568a299e8187bb3b230) Review URL: https://codereview.chromium.org/2257203003 . Cr-Commit-Position: refs/branch-heads/2832@{#2} Cr-Branched-From: 6c7eba987dc174e1522212efec1676619aa26a5a-refs/heads/master@{#412743} [modify] https://crrev.com/930a07e51ed363faa31a9f54625c86da1ee171e5/third_party/WebKit/LayoutTests/editing/selection/mouse/drag_user_select_none.html [delete] https://crrev.com/aa8710c62e2b42c85ffba2b45bc8d9e3ab899954/third_party/WebKit/LayoutTests/editing/selection/mouse/select_user_select_in_shadow.html [modify] https://crrev.com/930a07e51ed363faa31a9f54625c86da1ee171e5/third_party/WebKit/Source/core/dom/Node.cpp
,
Aug 18 2016
Issue 639116 has been merged into this issue.
,
Aug 18 2016
Let's please figure out how to write regression tests for this issue so it doesn't happen again. Thanks.
,
Aug 19 2016
Users experienced this crash on the following builds: Win Canary 54.0.2832.0 - 247.19 CPM, 805 reports, 672 clients (signature [Renderer hang] blink::FlatTreeTraversal::traverseParent) Win Canary 54.0.2832.0 - 140.64 CPM, 458 reports, 413 clients (signature [Renderer hang] blink::canBeDistributedToInsertionPoint) If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates. - Go/Fracas
,
Aug 19 2016
Thanks all for fixing the issue. We should have more D&D tests on shadow DOM trees.
,
Aug 19 2016
Issue is not seen on latest 54.0.2832.2 Build. Verified YouTube,Gmail,Crbug.com,Google search etc Attaching Video for Reference
,
Aug 19 2016
Tested this issue on Windows-10 and Ubuntu 14.04 using chrome latest canary M54-54.0.2832.2 and observed no issues in playing videos. Tested the same on Mac OS 10.11.6 using chrome latest canary and still the issue is observed on edition.cnn.com and foxnews.com, No issues seen on playing YouTube videos. Steps to repro: ---------------- 1. Navigate to Edition.cnn.com or Foxnews.com 2. Wait until the page loads completely 3. Click on any videos or links from the page 4. At first time no issues are seen in playing videos or opening links 5. Click on home page 6. Follow steps 2 & 3 7. Unable to navigate to any of the links Bisect Information: --------------------- Good build: 54.0.2831.0 Bad Build : 54.0.2832.0 Unable to provide the tool bisect CL due to continuous good builds, so providing manual CL from omahaproxy Change Log URL: --------------- https://chromium.googlesource.com/chromium/src/+log/54.0.2831.0..54.0.2832.0?pretty=fuller&n=10000 Could anyone please check this issue, Attaching screen-cast for reference. Please let us know is this is the same bug or do we need to file a different one for this issue? Thanks!
,
Aug 19 2016
Tried Bisecting the issue with below steps: Steps: ====== 1) Open chrome and search "Olympics 2016"(or anything) 2) Able to click on the links of the page 3) Now scroll once down/up and try clicking the links 4) The links are not clickable even if the page is refreshed/reloaded. Attached screen cast of the same for reference. The issue is seen only on Mac and working fine on Win and Linux. Bisect info: ============= Good: 54.0.2830.0/54.0.2831.0 Bad : 54.0.2832.0 Change Log: https://chromium.googlesource.com/chromium/src/+log/7f781f34f09fe2f3c5117f71de47e38d9bb59bad..806556451c84f03082ece3818862bbc22fd2727b Possible suspect : https://codereview.chromium.org/2245393002 yosin@ : Could you please take a look into this if its the cause.
,
Aug 19 2016
Filed a new issue 639501 to track the Mac OSX bug in # 24.
,
Aug 20 2016
,
Aug 22 2016
The bug shown in # 24 on Mac OSX is tracked in issue 639046 [Fixed already] yoichio/wfh@, can you please mark this bug as Fixed as the original issue reported in description is not seen on Windows & Linux.
,
Aug 23 2016
The issue is not seen on Windows.
,
Aug 23 2016
Tested the same on win10, mac 10.11.5 and Linux 14.04 chrome version 54.0.2837.0 - all the videos in youtube are playing fine on scrolling the page up and down and on reloading the page multiple times. Adding TE-Verified labels |
||||||||||||||||
►
Sign in to add a comment |
||||||||||||||||
Comment 1 by brajkumar@chromium.org
, Aug 18 2016Components: Internals>Media>Video
Labels: Needs-Bisect ReleaseBlock-Dev
Status: Untriaged (was: Unconfirmed)